Binary authenticity

Speedwave signs its desktop artifacts at two separate layers, and each layer covers a different moment: installing the app for the first time, and updating an app you already have. See Security for how this fits alongside the rest of the security model.

Code signing protects the first install

On macOS, Speedwave signs every binary bundled inside Speedwave.app with the Speednet Developer ID Application certificate, including the bundled Lima, Node.js, the Swift helpers, and the Rust CLI. Each binary uses Hardened Runtime and carries an Apple timestamp. Speedwave submits the full bundle to Apple Notary Service and staples the resulting ticket to the app, so Gatekeeper can validate it offline.

This layer checks every time you download the DMG and every time you launch the app afterward. It stops three things: a binary modified in transit fails Gatekeeper’s signature check, only whoever holds the Speednet private key can produce artifacts that pass, and Hardened Runtime blocks common ways of injecting code into a running binary.

Signed updates protect installed apps

Once Speedwave is installed, its auto-updater checks every downloaded update against an Ed25519 public key embedded in the app. The matching private key lives in CI, not on any developer machine. An attacker who compromised the release download location but not that CI key cannot ship an update: the updater refuses to install anything unsigned or signed with the wrong key. Read Updates and recovery for how the update itself gets fetched and applied.

Why both layers matter

A fresh install only ever goes through code signing, since a new install never touches the updater. An auto-update goes through both: the updater checks the signature, and Gatekeeper still validates the new app on next launch. That difference matters for what a stolen key can do. Someone who only has the Apple signing key can still trick new users into installing a malicious build from a replaced download, because the updater check never runs on a first install. Someone who only has the update signing key can push a bad update, but it would then fail Gatekeeper and crash on launch, which makes the attack visible instead of silent. Treat the Apple Developer ID as the key that matters most to protect: the update signature is a second layer, not a replacement for it.